Closed Bug 1488161 Opened 7 years ago Closed 6 years ago

Review / Investigation: Figure out how hard it is to XSS through Readability

Categories

(Firefox Graveyard :: Security: Review Requests, task, P3)

Product:
Firefox Graveyard
Component:
Security: Review Requests
Type:
task

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: freddy, Assigned: freddy)

References

(
URL
)

Details

(Whiteboard: audit)

Many of our projects use Readability to extract content from a DOM (e.g., reader mode, email tabs testpilot add-on). Our projects generally do not rely on Readability to produce safe HTML and use their own sanitizers. However, it would still be valuable to take a closer look at the library to see how feasible it is to get an XSS through Readability. Could maybe using some fuzzing with something like https://github.com/mozfreddyb/escape-artist/
Whiteboard: testing → audit
Type: defect → task

I doubt this will need a written review summary, so closing as resolved/fixed. Further work will happen in the depending bug.

Assignee: nobody → fbraun
Depends on: 1565931

(In reply to Frederik Braun [:freddyb] from comment #1)

I doubt this will need a written review summary, so closing as resolved/fixed. Further work will happen in the depending bug.

Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Product: Firefox → Firefox Graveyard
You need to log in before you can comment on or make changes to this bug.